IIS Express is a great addition to the tools for .NET web developers; it allow a slightly cut down copy of IIS 7.5 to be run without administrative privileges on a developer’s PC. This means we can hopefully get away from the problems associated by either
- Using Cassini – which is not IIS and does not do any clever
- Using full IIS which means Visual Studio has to run as administrator to debug it and also causes source control issues when a project is shared between multiple developers (their IIS setup must match up)
If you install Visual Studio 2010 SP1 and IIS express you now get a new option, that is to use IIS express as your web server. This, via a few clicks, can be configured for SSL and should address 90%+ of the needs of most developers. Once a project is set to use IIS express the key properties are set via the VS Property windows
However you are not limited to only editing these options; but to do more you need to use some command line tools.
What I wanted to do
My problem was that I wanted to test a Windows Phone 7 application that used a WCF web service. If I switched the WCF project to use IIS Express the WP7 application could not access the web server as, for security reasons, IIS Express is by default limited to only responding to requests from the localhost. The WP7 application is on another device (or at least a VM for development), so its request are not handled.
So we need to enable remote access to the server. ScottGu said this can be done in his post about IIS Express, but not how to do it.
Also I wanted to test my WP7 application using HTTPS. This raised a second issue. By default IIS express uses a self signed certificate. When this is used the WP7 WCF client throws as error as it cannot validate the certificate. I needed to swap the certificate for a ‘real one’. Again ScottGu’s post says it can be done but not how.
How I got it working
NOTE: I think the process covers all the steps, but it took me a while to get this going so there is a chance I might have missed step. Please treat this as outline guide and not definitive way to get it going. if I find errors I will update the post and highlight them.
Step 1 – Get the right Certificate onto the Development PC
I had already installed the wildcard SSL certificate we have on my development PC from ita .PFX file.
To confirm this was OK I load MMC (running as a local administrator). Loaded the certificates snap-in, browsed to Personal|Certificates and checked it was there. I then clicked on the certificate and made a note of its thumbprint, you need it later
Step 2 – List the certificates you have installed for IIS
I opened a command prompt as administrator and run the command
netsh http show sslcert
This will stream past so you probably want to pipe it into a file to look at. Anyway you should find an entry for the self sign certificate that Visual Studio created when you setup IIS Express (on port 44300 in my case). Something like
IP:port : 0.0.0.0:44300
Certificate Hash : c3a234250edfb2adcd2b501cf4c44d0281e29476
Application ID : {214124cd-d05b-4309-9af9-9caa44b2b74a}
Certificate Store Name : MY
Verify Client Certificate Revocation : Enabled
Verify Revocation Using Cached Client Certificate Only : Disabled
Usage Check : Enabled
Revocation Freshness Time : 0
URL Retrieval Timeout : 0
Ctl Identifier : (null)
Ctl Store Name : (null)
DS Mapper Usage : Disabled
Negotiate Client Certificate : Disabled
We need to remove this self signed certificate so we can re-assign a real one to this port. To do this use the command
netsh http delete sslcert ipport=0.0.0.0:44300
then add the new certificate association using the command
netsh http add sslcert ipport=0.0.0.0:44300 certstorename=MY certhash=
appid=
if you have the command line right it should say added OK. You could then run the list command again to check it is as you want.
So where are we up to…..
So at this point we have associated a real SSL certificate with any call to the port 44300 on this PC, note any call to this port, not just for IIS Express. If we do nothing else to configure IIS Express, let Visual Studio automatically start it, and try to load the site it will work for HTTP but when you try HTTPS it will error
If you inspect the certificate you will see it is using the one you set, but the certificate is linked to a Url, in my case *.blackmarble.co.uk so is deemed invalid when you try to use it with localhost.
We need to set IIS Express to respond on other addresses than localhost.
Step 3 – Making IIS Express respond to requests from the network
If you wish to make IIS Express respond to calls other than for localhost you have to run it as administrator, this is by design for security. Now it is fair to say from here onwards you are at the point where you lose some of the ease of use of the product as it does not ‘just work form Visual Studio’, but needs must.
We now need to edit the bindings of IIS Express. This could be done with command
c:program filesiis express>appcmd set site “SiteName” /+bindings.[protocol=‘https’, bindingInformation=’*:44300:’]
But I found it easier just to edit the edit the file C:Users[user name]DocumentsIISExpressconfigapplicationhost.config in notepad. I altered the bindings section as follows
Basically I removed the :localhost at the end of each line. This allowing IIS Express to bind any Url not just localhost
Step 4 – Running IIS Express
You now need to just start your copy of IIS Express, this again has to be done from the command prompt running with administrative privileges. However, the command line parameters are identical to those used by Visual Studio (you can check task manager if you wish by showing the command line column on the processes tab)
“c:Program Files (x86)IIS Expressiisexpress.exe” /config: “c:Documents and Settings[username]DocumentsIISExpressconfigapplicationhost.config” /site:“MyServer” /apppool:“Clr4IntegratedAppPool”
When you run this you should see the IIS Express process start-up.
So what have we ended up with?
So we now have IIS Express running the a wildcard certificate and listening to requests from any source. So as long as we use a Url valid for the SSL certificate we should be be able to load an HTTPS Url and get no errors.
However, be warned, due to the way we have had to launch IIS Express we have lost the ability to launch and debug from Visual Studio when not running as administrator. So I am not sure I have addressed the problem I started out try to address, I might as well just use the full version of IIS.
But look on the bright side I learnt something.
Thanks to Andy Westgarth for his assistance in getting to the bottom of assigning the right certificate, I was going in circles